China’s Online Black Market — Part I: Tencent QQ Credentials
Like on the rest of the world, in China some users’ online credentials and data are either used without their permission by some Internet companies to their benefit or traded on the black market. While some are common practices worldwide, there are some that can only happen in China.
TOMsInsight, an online data analysis and research service founded by veterans from Microsoft, Baidu and McKinsey, concludes that some tactics or even cyber crimes by Chinese copycats in order to gain or engage users are the major causes of the failure of many Internet services from outside China. It’s called by many “The Black Barrier”.
TOMsInsight has recently released a series of reports on China’s online black market. Here are my takeaways, what we have long heard about that are unique about the Chinese Web.
QQ Credentials
After Tencent’s QQ IM became very popular in China, there was a time when everyone’s QQ account was “stolen” — infected by malware. And we learned to tell if our QQ contacts’ accounts were “stolen”: You received messages from those accounts saying they needed money for various reasons or tricking you into clicking on malicious links or ads.
Sending fraudulent messages is a common practice among cyber criminals worldwide, but QQ ecosystem is different from many other social networks in many ways that cyber-thefts can take advantage of.
There’s a fortune already in the accounts: QQ Coin, virtual item and QQ account number itself.
Unlike today’s mobile in-app purchases that make payments real-time, years back on Chinese PCs, QQ users who played games on QQ platform and wanted to purchase virtual items had to buy QQ Coin, the virtual currency used in the QQ ecosystem, in advance. Thefts would sell the unused QQ Coins sitting in the “stolen” accounts for real money.
It could be even better if those users spent all the QQ Coins for virtual items in games or other virtual properties, for those could be sold at a premium. If a thief is lucky, some virtual weapons or roles in games could be very very expensive.
One of the most interesting phenomena created by QQ users is the value added to QQ account numbers. Every QQ account is assigned a number — It’s because QQ IM was created as the online counterpart of pagers which are identified by numbers. And back in 1999 when QQ was launched, few Chinese users had e-mail accounts. The QQ number began with 10001, which is believed held by Tencent CEO Pony Ma, and the latest are ten-digit numbers. The five-digit and six-digit QQ numbers, or numbers considered lucky or of significance, such as 888888, have been sold at high prices. And those numbers must be the major targets of thefts.
Over the years Tencent have done a lot to protect user accounts from being “stolen”. We didn’t hear that many theft cases in recent years, but the “stolen” on the black market are still good enough for traders. The second-hand account buyers are not intended to ask for money directly. Instead they may use the accounts to promote their own online services, such as posting ads as a QQ user in Q-zone, the Facebook-like service by Tencent supported by QQ account system, or send mails to contacts’ QQ Mail boxes.
